Remove Advertising Remove Antivirus Remove Cryptocurrency
article thumbnail

An Interview With the Target & Home Depot Hacker

Krebs on Security

That investigation detailed how the 38-year-old Shefel adopted the nickname Rescator while working as vice president of payments at ChronoPay , a Russian financial company that paid spammers to advertise fake antivirus scams, male enhancement drugs and knockoff pharmaceuticals. “Hi, how are you?” ” he inquired.

article thumbnail

FBI warns of malicious free online document converters spreading malware

Security Affairs

” Fake file converters and download tools may perform advertised tasks but can provide resulting files containing hidden malware, giving criminals access to victims’ devices. They can also steal personal data, banking details, cryptocurrency info, emails, and passwords by scraping the files the users upload.

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

Banshee macOS stealer supports new evasion mechanisms

Security Affairs

In August 2024, Russian crooks advertised a macOS malware called BANSHEE Stealer that can target both x86_64 and ARM64 architectures. The malware authors claimed it can steal a broad range of data from compromised systems, including browser data, cryptocurrency wallets, and around 100 browser extensions.

article thumbnail

New SteelFox Trojan mimics software activators, stealing sensitive data and mining cryptocurrency

SecureList

While these droppers do have the advertised functionality, they also deliver sophisticated malware right onto the user’s computer. Malicious dropper advertisement SteelFox dropper In this research, we describe the sample imitating an activator for Foxit PDF Editor. The full list of extracted data is provided below.

article thumbnail

SilentCryptoMiner Infects 2,000 Russian Users via Fake VPN Tools

eSecurity Planet

A new wave of cyberattacks is sweeping through Russia as cybercriminals deploy the so-called SilentCryptoMiner a cryptocurrency miner masquerading as a legitimate internet bypass tool. Attackers package the SilentCryptoMiner within archives advertised as deep packet inspection (DPI) bypass utilities.

VPN
article thumbnail

Undercover miner: how YouTubers get pressed into distributing SilentCryptoMiner as a restriction bypass tool

SecureList

Most active of all have been schemes for distributing popular stealers, remote access tools (RATs), Trojans that provide hidden remote access, and miners that harness computing power to mine cryptocurrency. This technique is used to hinder automatic analysis by antivirus solutions and sandboxes. Gaining persistence in the system.

article thumbnail

Lumma Stealer – Tracking distribution channels

SecureList

The attackers clone these websites and inject malicious advertisements into the cloned page that redirect users to a malicious CAPTCHA. Fake Telegram channels for pirated content and cryptocurrencies. When a user searches for such content, the fraudulent channels appear at the top of the search.